Security Vulnerabilities fixed in npm RHSA-2020:4272

Description

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (12.18.4). Security Fix(es): * nodejs-dot-prop: prototype pollution (CVE-2020-8116) * nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201) * npm: Sensitive information exposure through logs (CVE-2020-15095) * libuv: buffer overflow in realpath (CVE-2020-8252) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * The nodejs:12/development module is not installable (BZ#1883966)

Affected Applications

npm

CVE References

CVE-2020-15095 CVE-2020-8116 CVE-2020-8201 CVE-2020-8252

Other References

https://access.redhat.com/errata/RHSA-2020:4272